Processing of personal data

We inform you of the fact that, pursuant to Article 13 of Regulation (EU) 2016/679 (GDPR 2016/679), laying down provisions for the protection of individuals with regard to the processing of personal data, the personal data you provide will be processed in compliance with the aforementioned legislation and in accordance with the principles of lawfulness, fairness, transparency and protection of your privacy and your rights, with particular reference to integrity, confidentiality, personal identity and the right to protection of personal data.

Purposes of the processing for which the data are intended

The personal data you provide will be used for the following purposes:

• perform the services requested, enable effective management of contractual relationships with customers/suppliers in order to respond to requests for information, assistance, suggestions and/or specific needs reported by you;

• Send communications inherent to the services offered, newsletters and personalized news, containing promotional material and initiatives by traditional means or by automated means (electronic mail).

Mode of treatment

The processing will be carried out in automated and/or manual form, with methods and tools, in compliance with the security measures set out in Art. 32 of GDPR 2016/679, by specially appointed individuals, in compliance with the provisions of Art. 29 GDPR 2016/679. Security measures will be employed to ensure the confidentiality of the data subject to whom such data relate and to prevent undue access to third parties or unauthorized personnel.

Conservation

We would like to inform you that, in compliance with the principles of lawfulness, purpose limitation and data minimization, in accordance with Article 5 GDPR 2016/679, the storage period of your personal data is established for a period of time not exceeding the achievement of the purposes for which they are collected and processed and in compliance with the time limits prescribed by law.

Nature of Contribution

The provision of data is optional, however, any refusal to provide them will result in the impossibility for CSA Srl to proceed with the full provision of the services offered.

Scope of communication and dissemination

The data collected will not be disseminated; personal data, in connection with the above purposes, may be disclosed to the following categories of recipients:

• consultants outside the company engaged in processing and/or consulting operations for tax replacements;

• Public entities to which the data must be disclosed by law (social security and welfare agencies, financial offices, etc.);

• parent, subsidiary and associated companies to which CSA Srl entrusts certain activities.

Transfer of data to third countries

The Data Controller does not transfer personal data to third countries; however, it reserves the possibility of using cloud services and in that case the service providers will be selected from among those who provide adequate guarantees, as provided by Article 46 GDPR 2016/679.

Owner, Data Processor and DPO

The Data Controller is CSA Srl, in the person of the legal representative. The updated list of Data Processors is kept at the head office of the business, in strada San Giuseppe n. 15, località Ponteghiara, 43039 Salsomaggiore Terme (PR). A DPO has not been appointed.

Rights of the data subject

At any time, you may exercise, pursuant to Articles 15-22 of GDPR 2016/679, the right to:

• Request confirmation of the existence or non-existence of their personal data;
• Obtain information about the purposes of the processing, the categories of personal data, the recipients or categories of recipients to whom the personal data have been or will be disclosed, and, when possible, the retention period;
• Obtain rectification and deletion of data;
• Obtain restriction of processing;
• Obtain portability of data, i.e., receive them from a data controller, in a structured, commonly used, machine-readable format, and transmit them to another data controller without hindrance;
• To object to the processing at any time and also in the case of processing for direct marketing purposes;
• Object to automated decision-making related to natural persons, including profiling.